Fix varlock run on Windows: correct cmd.exe command string quoting

[Copilot]

varlock run fails on Windows when spawning .cmd-backed commands like tsx or pnpm. Two failure modes:

• tsx watch src/index.ts → The system cannot find the path specified.
• pnpm dlx auth generate → "dlx" "auth" "generate" is not recognized as an internal or external command

Root cause

The needsShell block in exec.ts was individually quoting each token:

"C:\path\tsx.cmd" "watch" "src/index.ts"

cmd.exe /s /c strips only the first and last " from the entire string, leaving a stray " after the command name:

C:\path\tsx.cmd" "watch" "src/index.ts   ← invalid path, broken args

Changes

• Fix quoting: wrap the entire inner command string in a single outer "..." pair, so cmd.exe's /s stripping consumes only those outer quotes and leaves the inner content intact:

  ""C:\path\tsx.cmd" "watch" "src/index.ts""
  → after /s strip →
  "C:\path\tsx.cmd" "watch" "src/index.ts"   ✓
  

• Always quote all tokens: command path and every arg are now consistently wrapped in ", with embedded " escaped as "" (cmd.exe convention). Extracted escapeCmdExeArg() helper to avoid duplication.
• PATHEXT fallback: when findCommand can't resolve a bare name to a .cmd/.bat path, needsShell now also fires so cmd.exe performs its own PATHEXT lookup (tsx → tsx.cmd, pnpm → pnpm.cmd) instead of failing with ENOENT.

[changeset-bot]

🦋 Changeset detected

Latest commit: 485322d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 18 packages

Name	Type
varlock	Patch
@varlock/astro-integration	Patch
@varlock/cloudflare-integration	Patch
@varlock/expo-integration	Patch
@varlock/nextjs-integration	Patch
@varlock/vite-integration	Patch
@varlock/1password-plugin	Patch
@varlock/aws-secrets-plugin	Patch
@varlock/azure-key-vault-plugin	Patch
@varlock/bitwarden-plugin	Patch
@varlock/dashlane-plugin	Patch
@varlock/google-secret-manager-plugin	Patch
@varlock/hashicorp-vault-plugin	Patch
@varlock/infisical-plugin	Patch
@varlock/keepass-plugin	Patch
@varlock/pass-plugin	Patch
@varlock/passbolt-plugin	Patch
@varlock/proton-pass-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/varlock@618

commit: 485322d

[philmillman]

tested (and repro'd) on win11 pro with npm/npx and it works